{"record":{"id":"e1593265f999a87c","repo":"dbt-labs/dbt-core","slug":"secret-environment-variables-starting-with-secre","errorCode":null,"errorMessage":"Secret environment variables (starting with {SECRET_ENV_VAR_PREFIX}) cannot be accessed here","messagePattern":"Secret environment variables \\(starting with (.+?)\\) cannot be accessed here","errorType":"exception","errorClass":"minijinja::Error (InvalidOperation)","httpStatus":null,"severity":"error","filePath":"crates/dbt-jinja-vars/src/env_var.rs","lineNumber":53,"sourceCode":"#[allow(clippy::type_complexity)]\npub fn env_var(\n    placeholder_on_secret_access: bool,\n    overrides_fn: Option<&LookupFn>,\n    tracker: Option<&dyn Fn(&str, &str)>,\n    _state: &State,\n    args: &[Value],\n) -> Result<Value, Error> {\n    let iter = ArgsIter::new(\"env_var\", &[\"var\"], args);\n    let var = iter.next_arg::<&str>()?;\n    let default = iter.next_kwarg::<Option<&Value>>(\"default\")?;\n\n    if let Some(value) = overrides_fn.and_then(|f| f(var)) {\n        return Ok(value);\n    }\n\n    let is_secret = var.starts_with(SECRET_ENV_VAR_PREFIX);\n    if is_secret && !placeholder_on_secret_access {\n        let err = Error::new(\n            ErrorKind::InvalidOperation,\n            format!(\n                \"Secret environment variables (starting with {SECRET_ENV_VAR_PREFIX}) \\\n                cannot be accessed here\"\n            ),\n        );\n        return Err(err);\n    }\n    let is_internal = var.starts_with(DBT_INTERNAL_ENV_VAR_PREFIX);\n    if is_internal {\n        let err = Error::new(\n            ErrorKind::InvalidOperation,\n            format!(\n                \"Environment variables (starting with {DBT_INTERNAL_ENV_VAR_PREFIX}) \\\n                cannot be accessed here\"\n            ),\n        );\n        return Err(err);","sourceCodeStart":35,"sourceCodeEnd":71,"githubUrl":"https://github.com/dbt-labs/dbt-core/blob/0267ce9170576975b76b64ce856b2e5848e96617/crates/dbt-jinja-vars/src/env_var.rs#L35-L71","documentation":"The `env_var` Jinja function refuses to read environment variables whose name starts with the reserved secret prefix `DBT_ENV_SECRET`. These variables are meant to be resolved through dbt's secret-handling pipeline (replaced with a placeholder) rather than being read directly in contexts where `placeholder_on_secret_access` is false. Reading them inline would leak secret values into compiled output or logs, so the library hard-errors instead.","triggerScenarios":"Calling `{{ env_var('DBT_ENV_SECRET_MY_KEY') }}` (any var name starting with `DBT_ENV_SECRET`) from Jinja while the `env_var` invocation was built with `placeholder_on_secret_access = false`. Overrides via `overrides_fn` that return a value bypass the check, but a direct environment lookup of a secret-prefixed name errors immediately at env_var.rs:53.","commonSituations":"Users reference secret env vars (e.g. `DBT_ENV_SECRET_API_TOKEN`) directly in models, schemas.yml, or profiles-rendering Jinja in a context that does not support secret placeholders, such as certain compile modes, docs generation, or partial parsing paths where placeholder substitution is disabled.","solutions":["Remove the `DBT_ENV_SECRET` prefix from the variable name if it is not actually a secret, or store the value under a non-reserved name.","Access the secret through dbt's supported secret-resolution path (the invocation with `placeholder_on_secret_access = true`, which returns the `$$$DBT_SECRET_START$$${}$$$DBT_SECRET_END$$$` placeholder instead of erroring).","Pass the value via an override lookup (`overrides_fn`) if you are embedding/running dbt programmatically and control env resolution.","If you only need a fallback, use `env_var('NAME', default=...)` with a non-secret variable name."],"exampleFix":"// before (Jinja)\n{{ env_var('DBT_ENV_SECRET_API_TOKEN') }}\n// after\n{{ env_var('API_TOKEN') }}  <!-- value exported without the reserved DBT_ENV_SECRET prefix -->","handlingStrategy":"try-catch","validationCode":"// Jinja pre-check\n{% if var_name.startswith('DBT_ENV_SECRET') %}{{ exceptions.raise_compiler_error('use the secret pipeline for ' ~ var_name) }}{% endif %}","typeGuard":null,"tryCatchPattern":"// Rust embedding dbt\nmatch env_var(false, None, None, &state, &args) {\n    Err(e) if e.to_string().contains(\"Secret environment variables\") => {\n        // route through secret-placeholder resolution (placeholder_on_secret_access = true)\n    }\n    other => other?,\n}","preventionTips":["Never reference DBT_ENV_SECRET_* variables directly in Jinja; use the secret pipeline","Reserve the DBT_ENV_SECRET prefix exclusively for secret values","Lint models/schemas for env_var calls with the secret prefix"],"tags":["jinja","env-var","secrets","dbt"],"backgroundTag":"missing-env-var","analyzedSha":"0267ce9170576975b76b64ce856b2e5848e96617","analyzedAt":"2026-09-07T21:53:39.732Z","contentChangedAt":"2026-09-07T21:53:39.732Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}